Net 12039 terminating gateway acl policy fix

[natemollica-nm]

Changes proposed in this PR

• Introduce handling of Consul AdminPartition ACL policy rules when global.adminPartitions.enabled: true

Current workflow requires end users to manually update the Terminating Gateway policies applied by the TerminatingGateway resource controller when AdminPartitions are enabled from:

namespace "default" {
  service_prefix "" {
    policy = "write"
  }
}

to

partition "default" {
  namespace "default" {
    service_prefix "" {
      policy    = "write"
      intention = "read"
    }
  }
}

How I've tested this PR

• Clone consul-k8s repository to $HOME/HashiCorp/consul-k8s
• Apply this branch's commits to locally cloned repo.
• Using https://github.com/hashicorp-support/consul-k3d-multicluster
  • From this repo, run make install-dev to deploy dev image with changes
• Verify the desired results of Consul ACL TerminatingGateway generated policies:

Test Matrix for ACL Policies and Admin Partitions with Terminating Gateway

Test Case	Admin Partitions Enabled	Partition Name	Service Type	Expected ACL Policy
Default Partition, Wildcard	Yes	default	Wildcard (*)	partition "default" { namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } } }
Default Partition, Specific	Yes	default	Specific (static-server)	partition "default" { namespace "default" { service "static-server" { policy = "write"; intention = "read"; } } }
Non-Default Partition, Wildcard	Yes	dev	Wildcard (*)	partition "dev" { namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } } }
Non-Default Partition, Specific	Yes	dev	Specific (static-server)	partition "dev" { namespace "default" { service "static-server" { policy = "write"; intention = "read"; } } }
No Partition, Wildcard	No	N/A	Wildcard (*)	namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } }
No Partition, Specific	No	N/A	Specific (static-server)	namespace "default" { service "static-server" { policy = "write"; intention = "read"; } }

How I expect reviewers to test this PR

👀

Checklist

• [] Tests added
• CHANGELOG entry added

[boruszak]

Some suggestions to align parameter descriptions with the style guide. Otherwise LGTM!

[boruszak]

Suggested change

	// ConsulPartition indicates the Consul Admin Partition name the controller is
	// operating in. Adds this value as metadata on managed resources.
	// ConsulPartition specifies the name of the Consul admin partition the controller
	// operates in. Adds this value as metadata on managed resources.

[boruszak]

Suggested change

	# A list of extra volumes to mount onto the snapshot agent. This
	# is useful for bringing in extra data that only the snapshot agent needs access
	# to. Like storage credentials. The value of this should be a list of objects.
	# A list of extra volumes to mount onto the snapshot agent. Use this block
	# to include extra data that only the snapshot agent needs access
	# to, such as storage credentials. This value should be a list of objects.

[boruszak]

Suggested change

	# - `type` - Type of the volume, must be one of "configMap" or "secret". Case sensitive.
	#
	# - `name` - Name of the configMap or secret to be mounted. This also controls
	# the path that it is mounted to. The volume will be mounted to `/consul/userconfig/<name>`.
	# - `type` - Type of the volume. Must be one of `configMap` or `secret`. Case sensitive.
	#
	# - `name` - Name of the configMap or secret to mount. This specification also controls
	# the path it mounts to. The volume will be mounted to `/consul/userconfig/<name>`.

[boruszak]

Suggested change

	# A list of extra environment variables to set on the snapshot agent specifically
	# This could be used to configure credentials that the rest of the
	# stateful set would not need access to, like GOOGLE_APPLICATION_CREDENTIALS
	# A list of extra environment variables to set on the snapshot agent specifically.
	# Use this parameter to configure credentials that the rest of the
	# stateful set would not need access to, like `GOOGLE_APPLICATION_CREDENTIALS`.